scap-security-guide November 2014

scap-security-guide@lists.fedorahosted.org

15 participants
10 discussions

2015 Red Hat Summit: Discounted passes for SSG & OpenSCAP community members
by Shawn Wells 25 Mar '15

25 Mar '15

Hey Guys, The 2015 Red Hat Summit (http://www.redhat.com/summit) will take place June 23-26 in Boston. The event may seem far away, but we all know how long it takes for integrators and govies to allocate training and travel budgets... :) This year we've ensured that _*any*_ member of the SSG & broader OpenSCAP community is eligible for discounted Summit passes at $950/pass (or $895/pass for groups of 4+). Doesn't matter if you're a code contributor, occasional voice on the mailing lists, or silent partner. For reference, the full conference pass is generally $1,975 (ref http://www.redhat.com/summit/rates/). In 2012 the SCAP session was standing room only, and in 2013 it was rated the #3 session (out of 196 sessions) by attendees. We hope to see you there this year! In full transparency: I don't get any RHT kickback or commissions off this. I received a special registration code that allows me to empirically show various managers/event staff how much interest there is in SCAP and Security Automation. For every 10 registrants that use the code, I get to send a RHT engineer to Red Hat Summit. Contact me _*off-list*_ if interested! -sdw

2 2

sshd banner warning
by Jeremiah Jahn 21 Jan '15

21 Jan '15

We used to have to keep out banners under /etc/issue for the console, and /etc/issue.net for remote access. Would it be okay to make this rule deal with either one? diff --git a/shared/oval/sshd_enable_warning_banner.xml b/shared/oval/sshd_enable_warning_banner.xml index 0bd8d32..ace8b75 100644 --- a/shared/oval/sshd_enable_warning_banner.xml +++ b/shared/oval/sshd_enable_warning_banner.xml @@ -25,7 +25,7 @@ </ind:textfilecontent54_test> <ind:textfilecontent54_object id="obj_sshd_banner_set" version="2"> <ind:filepath>/etc/ssh/sshd_config</ind:filepath> - <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue[\s]*(?:|(?:#.*))?$</ind:pattern> + <ind:pattern operation="pattern match">^[\s]*(?i)Banner(?-i)[\s]+/etc/issue(.net){0,1}[\s]*(?:|(?:#.*))?$</ind:pattern> <ind:instance datatype="int">1</ind:instance> </ind:textfilecontent54_object> </def-group>

5 9

Configuration testing vs Forensic testing
by Steve Grubb 07 Jan '15

07 Jan '15

Hello, I think there is a problem in the SSG content. I think that the current content is intended to check the system configuration. This would be done by examining the files on disk to warn about changes or thing that are misconfigured. There is also another category of testing that is forensics which checks the ephemeral / current values being enforced. Both are necessary and useful, but they should not be mixed. Some examples to illustrate the point: Forensic Configuration ----------------------------------------------------------------- auditctl -l vs cat /etc/audit/audit.rules mount vs cat /etc/fstab sysctl -a vs cat/etc/sysctl.conf service ip6tables status vs chkconfig ip6tables --list All these need to be changed in the prose to better express what the SCAP tool is actually checking. IOW, you can get different results by hand than the tool itself would report. This really needs to be addressed before anyone else uses SSG as the basis of their own recommendations. Again, forensic checking is useful and I would say content should be specifically designed with that in mind. But it is not what should be in a baseline. Thanks, -Steve

5 15

Waiver support in HTML report
by Martin Preisler 18 Dec '14

18 Dec '14

Hi, I wrote a short blog post about waivers in HTML report. These changes are coming in 1.2.0 so we would like to gather some feedback before the release. Suggestions welcome! http://martin.preisler.me/2014/11/waivers-in-openscap-html-report/ -- Martin Preisler

7 16

Use of RHEV
by Gabe Alford 21 Nov '14

21 Nov '14

Hello list, I wanted to ask if anyone is using RHEV at all especially in an IC/DoD environment. Has it been approved? Secured? What issues are there? Thanks, Gabe

6 12

Fwd: [OVAL-DEVELOPER-LIST] OVAL Language 5.11 Release Candidate 1 Available
by Shawn Wells 18 Nov '14

18 Nov '14

FYI - -------- Original Message -------- Subject: [OVAL-DEVELOPER-LIST] OVAL Language 5.11 Release Candidate 1 Available Date: Tue, 18 Nov 2014 16:21:06 -0500 From: Rothenberg, David B. <drothenberg(a)MITRE.ORG> Reply-To: OVAL Developer List (Closed Public Discussion) <OVAL-DEVELOPER-LIST(a)LISTS.MITRE.ORG> To: <OVAL-DEVELOPER-LIST(a)LISTS.MITRE.ORG> All, Version 5.11 Release Candidate 1 is now available for community review and comment. Attached is the change log for a full list of updates in this release. https://github.com/OVALProject/Language/tree/5.11-rc-1 https://github.com/OVALProject/Language/wiki#retrieving-a-specific-revision This Release Candidate includes support for several new platform schemas migrated from the OVAL Sandbox [1] as voted upon by the OVAL Board [2]. Some of these community contributions expands on the possible collection endpoints to include the mobile platforms Android and Apple iOS, and the network management protocol NETCONF. Changes made to the existing Independent, Windows, Linux, Solaris, and Cisco IOS schemas include new Tests, improved enumeration options, and clarified documentation. The Windows accesstoken_test, user_test, and group_test have all been deprecated in this version of the Language in favor of newer tests to address identified limitations. This is not a full list of all changes to be expected from the official OVAL 5.11 Language release, as other proposals are still being voted on by the OVAL Board. Please let us know if you have any questions or discover any issues while reviewing this Release Candidate. Thanks, David Rothenberg [1] https://github.com/OVALProject/Sandbox <https://github.com/OVALProject/Sandbox> [2] http://oval.mitre.org/community/board/voting_archive <http://oval.mitre.org/community/board/voting_archive> To unsubscribe, send an email message to LISTSERV(a)LISTS.MITRE.ORG with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to OVAL-DEVELOPER-LIST-request(a)LISTS.MITRE.ORG. -- Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells

1 0

First time running openscap, getting notapplicable
by Grant Schoep 16 Nov '14

16 Nov '14

Using RHEL 5.11 Built openscap-1.1.1 xccdf.xml source from Downloaded "Red Hat 5 Manual STIG - Version 1, Release 8" from http://iase.disa.mil/stigs/os/unix-linux/Pages/red-hat.aspx That contains the U_RedHat_5_V1R8_Manual-xccdf.xml file. I just tried running it, and all results show "notapplicable" Looking through the docs, it does seem to point out, and google seems to also point out that I need to be running on the right platform. It seems I am. This is truly a Redhat 5 workstation(or server), not CentOS. My command looks like this oscap xccdf eval --profile MAC-1_Public --results result.xml U_RedHat_5_V1R8_Manual-xccdf.xml The zip file from iase website didn't contain a CPE file, so I assumed one was not needed? Though I have a feeling this is my problem. NOTE, that when I running I do see this message to stderr WARNING: Skipping ./oval.xml file which is referenced from XCCDF content Really hoping to get this working, this seems a great tool.

2 7

List of test/fix sign offs
by Greg Elin 13 Nov '14

13 Nov '14

Shawn, A while back you showed me a list of what I would describe as sign-offs on the tests and fixes for the different profiles? Can you describe where to find that again? Also looking for 800-53 to CcE mappings? Thanks. Greg Elin P: 917-304-3488 E: gregelin(a)gitmachines.com Sent from my iPhone

2 1

RE: Waiver support in HTML report
by Chen, Wei (Contractor)(CFPB) 13 Nov '14

13 Nov '14

I think there should be an option to track the score even if a rule is waived. The score is a representation of risk, waiving the rule doesn't mean the risk disappeared but simply accepted. The amount of risk being accepted should be made available to the authorizing official or system owner. Also, a field for how long the waiver is valid for will be beneficial since permanent waivers are frowned upon in general. Regards, Wei ---------------------------------------------------------------------- ----- Original Message ----- > From: "Josh Kayse" <Joshua.Kayse(a)gtri.gatech.edu> > To: "Martin Preisler" <mpreisle(a)redhat.com> > Cc: "open-scap-list" <open-scap-list(a)redhat.com>, scap-workbench(a)lists.fedorahosted.org, "SCAP Security Guide" > <scap-security-guide(a)lists.fedorahosted.org> > Sent: Thursday, November 6, 2014 6:58:33 PM > Subject: Re: [Open-scap] Waiver support in HTML report > > > > On Nov 6, 2014, at 10:49 AM, Martin Preisler <mpreisle(a)redhat.com> wrote: > > > > Hi, > > I wrote a short blog post about waivers in HTML report. > > These changes are coming in 1.2.0 so we would like to gather > > some feedback before the release. > > > > Suggestions welcome! > > > > http://martin.preisler.me/2014/11/waivers-in-openscap-html-report/ > > This is awesome. I’ll echo Shawn Wells question about generating waivers. Replied about this to Shawn. > Additionally, does a waived rule still impact the score of the system? It does not. For all intents and purposes it behaves like a rule of the result the waiver set it to. So if you waive a failed rule and make it "pass" you basically make it behave exactly like a passed rule. -- Martin Preisler ------------------------------

2 1

Celebrating 20 years of Red Hat Linux
by Shawn Wells 01 Nov '14

01 Nov '14

Today Red Hatters around the world are celebrating the twentieth anniversary of the first release of Red Hat Linux, the Halloween release, that set the stage for what has become RHEL: http://red.ht/1tl2KYN Wanted to say thank you to everyone in the community who has participated in the OpenSCAP and SSG communities. Between the OpenSCAP interpreter and SSG projects there has been ~100 individuals contribute code across 8,113 patches and 1,639,072 lines of code [1][2]. OpenSCAP established itself as the only open source, NIST certified interpreter. The SSG project worked with government agencies, such as DISA FSO, NSA, and NRO, to not only release their baselines, but incorporate them into an open source project. RHEL now natively includes these tools and content to natively support security baseline attestation and continuous monitoring. It's been an amazing ride. Back in 1998 I rode my /bicycle/ to purchase Red Hat Linux 5.2 (I was in 5th grade!), as my Windows desktop crapped out. I didn't actually know what Linux was. All I knew was that I needed an operating system, and that the Red Hat box had a cheaper sticker price than the Microsoft one. After installing RHL I began exploring the Linux community, becoming fascinated by it. The open source model fascinated me. As a kid I imagined how amazing it'd be to someday work with the brightest minds possible, to create technology that would be used all over the world, to help make things better on a massive scale. Working with the OpenSCAP and SSG communities has fulfilled that personal dream. I can't imagine collaborating with a better group of people. Sincerely, on behalf of Red Hat, and on behalf of myself, thank you to everyone who has participated in the communities. Everyone here has touched technology that now ships in Linux. Take a second to reflect on that -- it's an amazing accomplishment! -Shawn [1] http://people.redhat.com/swells/gitstats/20141031-scap-security-guide/activ… [2] http://people.redhat.com/swells/gitstats/20141031-openscap/activity.html -- Shawn Wells Director, Innovation Programs shawn(a)redhat.com | 443.534.0130 @shawndwells

2 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

scap-security-guide November 2014